{"id":"CVE-2022-2884","published":"2022-10-17T00:00:00Z","modified":"2025-05-14T14:24:19Z","title":"A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to…","vendor":"GitLab","product":"GitLab","tier":"core","eol":null,"affectedVersions":[{"vendor":"GitLab","product":"GitLab","versions":[">=11.3.4, <15.1.5",">=15.2, <15.2.3",">=15.3, <15.3.1"]}],"description":{"text":"A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint","provenance":"source","from":"CVE.org"},"summary":{"text":"A command injection flaw (CWE-94 style OS command injection, per the weakness listed) exists in GitLab CE/EE, in the Import from GitHub API endpoint of the GitLab product. An attacker who holds a valid user account, with no user interaction and reachable network access to that endpoint, can achieve remote code execution on the affected instance.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:19Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.75718,"percentile":0.99521,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/371098","tags":[]},{"url":"https://hackerone.com/reports/1672388","tags":[]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json","tags":[]},{"url":"http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-35116","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35116","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":51181,"url":"https://www.exploit-db.com/exploits/51181","title":"GitLab v15.3 - Remote Code Execution (RCE) (Authenticated)","type":"webapps","platform":"ruby","date":"2023-04-01","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2023-04-01"},"pocGithub":{"count":1,"skipped":0,"earliest":"2022-12-22","earliestUrl":"https://github.com/m3ssap0/gitlab_rce_cve-2022-2884","repos":[{"name":"m3ssap0/gitlab_rce_cve-2022-2884","url":"https://github.com/m3ssap0/gitlab_rce_cve-2022-2884","stars":26,"created":"2022-12-22"}]},"first":{"date":"2022-12-22","source":"PoC-in-GitHub","url":"https://github.com/m3ssap0/gitlab_rce_cve-2022-2884"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2022-10-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-2884","provenance":"source"},{"date":"2022-12-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2023-04-01","url":"https://github.com/m3ssap0/gitlab_rce_cve-2022-2884","provenance":"source"}],"speed":{"daysToPublicExploit":66,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9952"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}